RE: Smells like a phish, is a fish?

I used the key provided by GoDaddy and the information it presented is
nothing more than you would receive through their WHOIS process.  In
fact, on the website, the instructions were that if I found an error, I
was to log in and fix it.  I was not logged in bu only using their
special key.

Christopher Reed
Web Applications Supervisor
Information Technology
City of Lubbock
creed@mail.ci.lubbock.tx.us
"The oxen are slow, but the earth is patient."

> > > "Damhuis Anton" <DamhuisA@aforbes.co.za> 3:34 am 10/27/2005 >>>

Hi

But email is sent over an unencrypted link, thus any body could get
hold of the link, and by entering it, get access to the web site's
details (the account).

Something should always be kept secret, when sending logon information
via email.

So I don't think it is mitigating phishing, but possibly rather a way
to track their responses to the email.

Or am I understanding your statement incorrectly?

Regards
  Anton

-----Original Message-----
From: Ofer Shezaf [mailto:Ofer.Shezaf@breach.com] 
Sent: 27 October 2005 10:15
To: Andrew van der Stock; webappsec@securityfocus.com 
Subject: RE: Smells like a phish, is a fish?

...
provide you with a key in the e-mail, rather than asking for a login
might actually be a way to mitigate phishing.